E-Discovery & Digital Information Management

Transcription

1 T h e Se d o n a Co n f e r e n c e Wo r k i n g Gr o u p Se r i e s SM Th e Se d o n a Co n f e r e n c e Glossary: E-Discovery & Digital Information Management (Third Edition) A Project of The Sedona Conference Working Group On Electronic Document Retention & Production (WG1) RFP+ Group September 2010 Version Reprinted courtesy of The Sedona Conference Copyright 2010, The Sedona Conference

2 The Sedona Glossary: for E-Discovery and Digital Information Management (Third Edition) Editor: Sherry B. Harris, Law Offices of Conor R. Crowley Contributing Editor: Paul H. McVoy, Milberg LLP RFP+ Vendor Panel (see for a listing of the RFP+ Vendor Panel members) Editors and Contributors to the 2005 and 2007 Editions: 1 Conor R. Crowley, Esq., Labaton Sucharow & Rudoff LLP; Sherry B. Harris, Hunton & Williams LLP; Matthew I. Cohen, Esq., Skadden, Arps, Slate, Meagher & Flom; Megan E. Jones, Esq., Cohen, Milstein, Hausfeld & Toll, PLLC; Anne Kershaw, Esq., A. Kershaw, PC// Attorneys & Consultants; Mark V. Reichenbach, Merrill Lynch, OGC 1 With affiliations at the time of their work on the 2007 Edition. Copyright 2010 The Sedona Conference All Rights Reserved. REPRINT REQUESTS: Requests for reprints or reprint information should be directed to Richard Braman, Executive Director of The Sedona Conference, at rgb@sedonaconference.org or The opinions expressed in this publication, unless otherwise attributed, represent consensus views of the Editors and the members of The Sedona Conference Working Group on Electronic Document Retention and Protection RFP+ Group. They do not necessarily represent the views of any of the individual participants or editors or their employers, clients, or any other organizations to which any of the participants belong nor do they necessarily represent official positions of The Sedona Conference. Copyright 2010, The Sedona Conference Visit

3 Preface The Sedona Conference Glossary is published as a tool to assist in the understanding and discussion of electronic discovery and electronic information management issues; it is not intended to be an all-encompassing replacement of existing technical glossaries published by ARMA International ( American National Standards Institute ( International Organization for Standardization ( U.S. National Archives & Records Administration ( and other professional organizations. The Sedona Conference wishes to acknowledge the contributions of all the Working Group 1 and RFP+ Vendor Panel and User Group members who reviewed and commented on drafts of this Third Edition, as well as thank all of our Working Group Series SM Sponsors, whose support is essential to the ability of The Sedona Conference to develop Working Group Series SM publications such as this. For a complete listing of our Sponsors, click on the Sponsors navigation bar on the home page of our Web site at As with all of our publications, your comments are welcome. Please forward them to us at rgb@sedonaconference.org. Richard G. Braman Executive Director The Sedona Conference Sedona, AZ USA September,

4 The Sedona Conference Glossary Commonly Used Terms for E-Discovery and Digital Information Management 30(b)(6): Under Federal Rule of Civil Procedure 30(b)(6), a corporation, partnership, association, or governmental agency is subject to the deposition process, and required to provide one or more witnesses to testify as to matters known or reasonably available to the organization on the topics requested by the notice. Sometimes the 30(b)(6) topics concern the discovery process itself, including procedures for preservation, collection, chain of custody, processing, review, and production. Early in the litigation, when developing a discovery plan, particularly with regard to electronic discovery, a party should be mindful of the obligation to provide one or more 30(b)(6) witnesses should the request be made by another party to the litigation, and include this contingency in the discovery plan. Ablate: Describes the process by which laser-readable pits are burned into the recorded layer of optical disks, DVD-ROMs, and CD-ROMs. Ablative: Unalterable data. See Ablate. Acetate-base film: A safety film (ANSI Standard) substrate used to produce microfilm. ACL (Access Control List): A security method used by Lotus Notes developers to grant varying levels of access and user privileges within Lotus Notes databases. ACM (Association for Computing Machinery): Professional association for computer professionals with a number of resources, including a special interest group on search and retrieval. See Active Data: Information residing on the direct access storage media (disk drives or servers) that is readily visible to the operating system and/or application software with which it was created. It is immediately accessible to users without restoration or reconstruction. Active Records: Records related to current, ongoing, or in-process activities referred to on a regular basis to respond to day-to-day operational requirements. See Inactive Records. ADC: Analog to Digital Converter. Converts analog data to a digital format. Address: Addresses using a number of different protocols are commonly used on the Internet. These addresses include addresses (Simple Mail Transfer Protocol or SMTP), IP (Internet Protocol) addresses and URLs (Uniform Resource Locators), commonly known as Web addresses. ADF: Automatic Document Feeder. This is the means by which a scanner feeds a paper document. Adware: See Spyware. Agent: A program running on a computer that performs as instructed by a central control point to track file and operating system events and takes directed actions, such as transferring a file or deleting a local copy of a file, in response to such events. AIIM: The Association for Information and Image Management, It focuses on ECM (enterprise content management). 2

5 Algorithm: A detailed formula or set of rules for solving a particular problem. To be an algorithm, a set of rules must be unambiguous and have a clear stopping point. Aliasing: When computer graphics output has jagged edges or a stair-stepped, rather than a smooth, appearance when magnified. The graphics output can be smoothed using anti-aliasing algorithms. Alphanumeric: Characters composed of letters, numbers (and sometimes non-control characters, such #, $). Excludes control characters. Ambient Data: See Latent Data and Residual Data. Analog: Data in an analog format is represented by continuously variable, measurable, physical quantities such as voltage, amplitude, or frequency. Analog is the opposite of digital. Annotation: The changes, additions, or editorial comments made or applicable to a document - usually an electronic image file - using electronic sticky notes, highlighter, or other electronic tools. Annotations should be overlaid and not change the original document. ANSI: American National Standards Institute, - a private, non-profit organization that administers and coordinates the U.S. voluntary standardization and conformity assessment system. Aperture Card: An IBM punch card with a window that holds a 35mm frame of microfilm. Indexing information is punched in the card. API (Application Programming Interface): Interface implemented by an application to enable interaction with another application. See MAPI. Applet: a small program typically designed as an add-on to another program, allowing greater functionality for a specific purpose other than what the original program intended, e.g., a game applet for a Web browser. Appliance: A prepackaged piece of hardware and software designed to perform a specific function on a computer network, for example, a firewall. Application: A collection of one or more related software programs that enable an end-user to enter, store, view, modify, or extract information from files or databases. The term is commonly used in place of program or software. Applications may include word processors, Internet browsing tools, spreadsheets, clients, personal information managers (contact information and calendars), and other databases. Application Metadata: Data created by the application specific to the ESI being addressed, embedded in the file and moved with the file when copied; copying may alter application metadata. See also Metadata. Application Service Provider (ASP): An Internet-based organization hosting software applications on its own servers within its own facilities. Customers license the application and access it over the Internet or via a private line connection. See SaaS. Architecture: Refers to the hardware, software or combination of hardware and software comprising a computer system or network. Open architecture describes computer and network components that are more readily interconnected and interoperable. Closed architecture describes components that are less readily interconnected and interoperable. 3

6 Archival Data: Information an organization maintains for long-term storage and record keeping purposes, but which is not immediately accessible to the user of a computer system. Archival data may be written to removable media such as a CD, magneto-optical media, tape, or other electronic storage device, or may be maintained on system hard drives. Some systems allow users to retrieve archival data directly while other systems require the intervention of an IT professional. Archive, Electronic: Long-term repositories for the storage of records. Electronic archives preserve the content, prevent or track alterations, and control access to electronic records. ARMA International: A not-for-profit association and recognized authority on managing records and information, both paper and electronic, Artificial Intelligence (AI): The subfield of computer science concerned with the concepts and methods of symbolic inference by computer and symbolic knowledge representation for use in making inferences - an attempt to model aspects of human thought process with computers. It is also sometimes defined as solving by computer any problem once believed to be solvable only by humans. AI is the capability of a device to perform functions that are normally associated with human intelligence, such as reasoning and optimization through experience. It attempts to approximate the results of human reasoning by organizing and manipulating factual and heuristic knowledge. Areas of AI activity include expert systems, natural language understanding, speech recognition, vision, and robotics. ASCII (American Standard Code for Information Interchange): Pronounced ask-ee, a non-proprietary text format built on a set of 128 (or 255 for extended ASCII) alphanumeric and control characters. Documents in ASCII format consist of only text with no formatting and can be read by most computer systems. Aspect Ratio: The relationship of the height to the width of any image. The aspect ratio of an image must be maintained to prevent distortion. Attachment: A record or file associated with another record for the purpose of retention, transfer, processing, review, production, and routine records management. There may be multiple attachments associated with a single parent or master record. In many records and information management programs, or in a litigation context, the attachments and associated record(s) may be managed and processed as a single unit. In common use, this term often refers to a file (or files) associated with an for retention and storage as a single Message Unit. See Document Family, Message Unit, and Unitization. Attribute: A characteristic of data that sets it apart from other data, or property of a file aspect such as location, size, or type. The term attribute is sometimes used synonymously with data element or property. Audit Log or Audit Trail: An automated or manual set of chronological records of system activities that may enable the reconstruction and examination of a sequence of events and/or changes in an event. Author or Originator: The person, office, or designated position responsible for an item s creation or issuance. In the case of a document in the form of a letter, the author or originator is usually indicated on the letterhead or by signature. In some cases, a software application producing a document may capture the author s identity and associate it with the document. For records management purposes, the author or originator may be designated as a person, official title, office symbol, or code. Avatar: A graphical representation of a user in a shared virtual reality, such as Web forums or chat rooms. AVI (Audio-Video Interleave): A Microsoft standard for Windows animation files that interleaves audio and video to provide medium quality multimedia. Backbone: The top level of a hierarchical network. It is the main channel along which data is transferred. 4

7 Backfiles: Existing paper or microfilm files. Backup: To create a copy of active data as a precaution against the loss or damage of the original data. Many users backup their files, and most computer networks utilize automatic backup software to make regular copies of some or all of the data on the network. Backup Data: An exact copy of active ESI that serves as a source for recovery in the event of a system problem or disaster. Backup Data is generally stored separately from Active Data on portable media. Backup Data is distinct from Archival Data in that Backup Data may be a copy of Active Data, but the more meaningful difference is the method and structure of storage that impacts its suitability for certain purposes. Backup Tape: Magnetic tape used to store copies of ESI, for use when restoration or recovery is required. Backup tapes typically use data compression, which increases restoration time and expense, given the lack of uniform standards governing data compression. Backup Tape Recycling: Describes the process whereby an organization s backup tapes are overwritten with new data, usually on a fixed schedule determined jointly by records management, legal, and IT sources. For example, the use of nightly backup tapes for each day of the week with the daily backup tape for a particular day being overwritten on the same day the following week; weekly and monthly backups being stored offsite for a specific period of time before being placed back in the rotation. Bandwidth: The amount of data a network connection can accommodate in a given period of time. Bandwidth is usually stated in kilobits per second (kbps), megabits per second (mps), or gigabytes per second (gps). Bar Code: A small pattern of vertical lines or dots that can be read by a laser or an optical scanner. In records management and electronic discovery, bar codes may be affixed to specific records for indexing, tracking, and retrieval purposes. Batch File: A batch file is a set of one or more instructions that are created in a computer program to perform a particular type of computer system function (.BAT is the DOS batch file extension). Batch Processing: The processing of a large amount of ESI in a single step. Bates Number: Sequential numbering used to track documents and images in production data sets, where each page or file is assigned a unique production number. Often used in conjunction with a suffix or prefix to identify a producing party, the litigation, or other relevant information. See also Production Number. Baud Rate: The number of times per second a communications channel changes the carrier signal it sends on a phone line. A 2400-baud modem changes the signal 2400 times a second. Bayesian: Refers to the statistical approach of Thomas Bayes, an 18th century mathematician and clergyman. Bayes published a theorem that describes how to calculate conditional probabilities from the combinations of observed events and prior probabilities. Many information retrieval systems implicitly or explicitly use Bayes probability rules to compute the likelihood that a document is relevant to a query. BBS (Bulletin Board System): A computer system or service that users access to participate in electronic discussion groups, post messages, and/or download files. BCS: Boston Computer Society, one of the first associations of PC/Apple users (one of the largest and most active). 5

8 Beginning Document Number or BegDoc#: A unique number identifying the first page of a document or a number assigned to identify a native file. Bibliographical/Objective Coding: Manually recording objective information from documents such as date, authors/recipients/carbon copies, blind copies, and associating the information with a specific document. See Coding and Indexing. Binary: The Base 2 numbering system used in digital computing that represents all numbers using combinations of zero and one. BIOS (Basic Input Output System): The set of user-independent computer instructions stored in a computer s ROM, immediately available to the computer when the computer is turned on. BIOS information provides the code necessary to control the keyboard, display screen, disk drives, and communication ports in addition to handling certain miscellaneous functions. Bit: Binary digit - the smallest unit of computer data. A bit consists of either 0 or 1. There are eight bits in a byte. See Byte. Bitmap: A Bitmap provides information on the placement and color of individual bits, as well as allows the creation of characters or images by creating a picture composed of individual bits (pixels). Bit Stream Backup: A sector-by-sector/bit-by-bit copy of a hard drive. A Bit Stream Backup is an exact copy of a hard drive, preserving all latent data in addition to the files and directory structures. Bit Stream Backup may be created using applications such as Encase, SnapBack, and Ghost. See Forensic Copy. Bitonal: A bitonal image uses only black and white. BMP: A Windows file format for storing bitmap images. BMS (BlackBerry Messaging Service): A text message protocol for use between two or more BlackBerry devices and addressed using the devices PIN, a unique address assigned to all BlackBerrys. May also be referred to as BBM. Bookmark: A stored link to a Web site or page previously visited. Boolean Search: Boolean Searches use logical operators such as and, or, and not to include or exclude terms from a search. See Natural Language Search. Boot: To start up or reset a computer. Boot Sector/Record: See Master Boot Sector/Record and Volumn Boot Sector/Record. BPI (Bits Per Inch): A unit of measure of data densities in disk and magnetic tape systems. bps (bits per second): A measurement of the rate of data transfer. See Bandwidth. Broadband: Commonly used in the context of high bandwidth Internet access made available through a variety of quickly evolving technologies; the ability to divide bandwidth for sharing by multiple simultaneous signals increases transmission speed. Total available bandwidth may vary among providers. Brontobyte: 1,024 yottabytes. See Byte. 6

9 Browser: An application, such as Internet Explorer or Safari, used to view and navigate the World Wide Web and other Internet resources. Burn: The process of creating a copy of information onto a CD, DVD, or other storage media. Bus: A parallel circuit that connects the major components of a computer, allowing the transfer of electric impulses from one connected component to any other. Business Process Outsourcing ( BPO ): Business process outsourcing occurs when an organization turns over the management of a business function, such as accounts payable, purchasing, payroll, or information technology, to a third party. Byte (Binary Term): A Byte is the basic measurement of most computer data and consists of 8 bits. Computer storage capacity is generally measured in bytes. Although characters are stored in bytes, a few bytes are of little use for storing a large amount of data. Therefore, storage is measured in larger increments of bytes. See Kilobyte, Megabyte, Gigabyte, Terabyte, Petabyte, Exabyte, Zettabyte, Yottabyte, Brontobyte, and Geopbyte (listed here in order of increasing volume). Cache: A dedicated, high speed storage location that can be used for the storage of frequently used data. As data may be retrieved more quickly from cache than the original storage location, cache allows applications to run more quickly. Web site contents often reside in cached storage locations on a hard drive. Caching: The storing of frequently-used data to speed access. See also Cache. CAD (Computer Aided Design): The use of a wide range of computer-based tools that assist engineers, architects, and other design professionals in their design activities. Case De-Duplication: Eliminates duplicates to retain only one copy of each document per case. For example, if an identical document resides with three custodians, only the first custodian s copy will be saved. Also known as Cross Custodial De-Duplication, Global De-Duplication or Horizontal De-Duplication. See De-Duplication. Catalog: See Index. CCD (Charge Coupled Device): A computer chip of which the output correlates with the light or color passed by it. Individual CCDs or arrays of these are used in scanners as a high-resolution, digital camera to read documents. CCITT: Consultative Committee for International Telephone & Telegraphy. Sets standards for phones, faxes, modems, etc. The standard exists primarily for fax documents. CCITT Group 4: A lossless compression technique/format that reduces the size of a file, generally about 5:1 over RLE and 40:1 over bitmap. CCITT Group 4 compression may only be used for bi-tonal images. CDPD (Cellular Digital Packet Data): A data communication standard utilizing the unused capacity of cellular voice providers to transfer data. CD-R, CD+R (Compact Disk Recordable): See Compact Disk. CD-RW (Compact Disk Re-Writable): See Compact Disk. CD-ROM (Compact Disk Read-Only Memory): See Compact Disk. 7

10 Certificate: An electronic affidavit vouching for the identity of the transmitter. See Digital Certificate, Digital Signature, PKI Digital Signature. CGA (Color Graphics Adapter): See Video Graphics Adapter (VGA). Chaff/winnowing: Advanced encryption technique involving data dispersal and mixing. Chain of Custody: Documentation and testimony regarding the possession, movement, handling, and location of evidence from the time it is obtained to the time it is presented in court or otherwise transferred or submitted; used to prove that evidence has not been altered or tampered with in any way; necessary both to assure admissibility and authenticity. Character Treatment: The use of all caps or another standard format for treating letters in a coding project. Checksum: A value used to ensure data is stored or transmitted without error. It is created by calculating the binary values in a block of data using some algorithm and storing the results with the data. When the data is retrieved from memory or received at the other end of a network, a new checksum is computed and matched against the existing checksum. A non-match indicates an error. Child: See Document. CIE (Commission International de l Eclairage): The international commission on color matching and illumination systems. CIFS (Common Internet File System): Used for client/server communication within Microsoft operating systems. With CIFS, users with different platforms and computers can share files without having to install new software. Cine-Mode: Data recorded on a film strip such that it can be read by a human when held vertically. Cinepak: A compression algorithm; see MPEG. CITIS (Contractor Integrated Technical Information Service): The Department of Defense now requires contractors to have an integrated electronic document image and management system. Clawback Agreement: An agreement outlining procedures to be followed to protect against waiver of privilege or work product protection due to inadvertent production of documents or data. Client: Any computer system that requests a service of another computer system. A workstation requesting the contents of a file from a file server is a client of the file server. See Thin Client. Also commonly used as synonymous with an application, by reference to the Client. Client Server: An architecture whereby a computer system consists of one or more server computers and numerous client computers (workstations). The system is functionally distributed across several nodes on a network and is typified by a high degree of parallel processing across distributed nodes. With client-server architecture, CPU-intensive processes (such as searching and indexing) are completed on the server, while image viewing and OCR occur on the client. This dramatically reduces network data traffic and insulates the database from workstation interruptions. Clipboard: A holding area that temporarily stores information copied or cut from a document. 8

11 Cloud Computing: [A] model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. (last visited June 22, 2010). For further explanation see the NIST Web site cited. Cluster (File): The smallest unit of storage space that can be allocated to store a file on operating systems. Windows and DOS organize hard disks based on Clusters (also known as allocation units), which consist of one or more contiguous sectors. Disks using smaller cluster sizes waste less space and store information more efficiently. Cluster (System): A collection of individual computers that appear as a single logical unit. Also referred to as matrix or grid systems. Cluster bitmap: Used in NTFS (New Technology File System) to keep track of the status (free or used) of clusters on the hard drive. See NTFS. Clustering: See Data Categorization. CMYK: Cyan, Magenta, Yellow, and Black. A subtractive method used in four color printing and Desktop Publishing. Coding: Automated or human process by which documents are examined and evaluated using pre-determined codes, and the results recorded. Coding usually identifies names, dates, and relevant terms or phrases. Coding may be structured (limited to the selection of one of a finite number of choices), or unstructured (a narrative comment about a document). Coding may be objective, i.e., the name of the sender or the date, or subjective, i.e., evaluation as to the relevancy or probative value of documents. See Bibliographical/Objective Coding, Indexing, Level Coding, Subjective Coding, and Verbatim Coding. COLD (Computer Output to Laser Disk): A computer programming process that outputs electronic records and printed reports to laser disk instead of a printer. COM (Computer Output to Microfilm): A process that outputs electronic records and computer generated reports to microfilm. Comb: A series of boxes with their top missing. Tick marks guide text entry and separate characters. Used in forms processing rather than boxes. Comic Mode: Human-readable data, recorded on a strip of film that can be read when the film is moved horizontally to the reader. Comma Separated Value (CSV): A record layout that separates data fields/values with a comma and typically encloses data in quotation marks. Compact Disk (CD): A type of optical disk storage media, compact disks come in a variety of formats. These formats include CD-ROM ( CD Read-Only Memory ) - read-only; CD-R or CD+R ( CD Recordable ) - can be written to once and are then read-only; and CD-RW ( CD Re-Writable ) - can be written to multiple times. Compliance Search: The identification of and search for relevant terms and/or parties in response to a discovery request. 9

12 Component Video: Separates video into luminosity and color signals that provide the highest possible signal quality. Composite Video: Combines red, green, blue and synchronization signals into one video signal so that only one connector is required; used by most TVs and VCRs. Compound Document: A file that collects or combines more than one document into one, often from different applications, by embedding objects or linked data; multiple elements may be included, such as images, text, animation, or hypertext. See also OLE. Compression: Compression algorithms such as Zip and RLE reduce the size of files saving both storage space and reducing bandwidth required for access and transmission. Data compression is widely used in backup utilities, spreadsheet applications, and database management systems. Compression generally eliminates redundant information and/or predicts where changes will occur. Lossless compression techniques such as Zip and RLE preserve the integrity of the input. Coding standards such as JPEG and MPEG employ lossy methods that do not preserve all of the original information, and are most commonly used for photographs, audio, and video. See Container File, Decompression, Lossless Compression, and Lossy Compression. Compression Ratio: The ratio of the size of an uncompressed file to a compressed file, e.g., with a 10:1 compression ratio. Example: a 10 KB file can be compressed to 1 KB. Computer Forensics: Computer Forensics is the use of specialized techniques for recovery, authentication, and analysis of electronic data when an investigation or litigation involves issues relating to reconstruction of computer usage, examination of residual data, authentication of data by technical analysis, or explanation of technical features of data and computer usage. Computer forensics requires specialized expertise that goes beyond normal data collection and preservation techniques available to end-users or system support personnel, and generally requires strict adherence to chain-of-custody protocols. See also Forensics and Forensic Copy. Computer: Includes but is not limited to network servers, desktops, laptops, notebook computers, mainframes, and PDAs (personal digital assistants). Concatenate: Generally, to add by linking or joining to form a chain or series; two or more databases of similar structure can be concatenated to enable the user to reference them as one. Concept search: The use of word meanings to identify documents relevant to a specific query. Word meanings can be derived from any of a number of sources, including dictionaries, thesauri, taxonomies, ontologies, or computed mathematically from the context in which the words occur. Concept searching typically improves the relevance ranking of the search results and can identify additional documents that are meaningfully related to the query even if they do not have the specific query term in them. Conceptual Analytics: Using one or more of a number of mathematical algorithms or linguistic methodologies to group documents by their common themes or ideas.. Container File: A single file containing multiple documents and/or files, e.g.,.pst,.nsf and.zip files. The file must be ripped or decompressed to determine volume, size, record count, etc., and to be processed for litigation review and production. See Decompression and Rip. Content Comparison: A method of de-duplication that compares file content or output (to image or paper) and ignores metadata. See also De-Duplication. 10

13 Contextual Search: Using one of a number of mathematical algorithms or linguistic methodologies to enlarge search results to include not only exact term matches but also matches where terms are considered in context of how and where they frequently occur in a specific document collection or more general taxonomy. For example, a search for the term diamond may bring back documents related to baseball but with no reference to the word diamond because they frequently occur within the same documents and therefore have a logical association. Continuous Tone: An image (e.g., a photograph) that has all the values of gray from white to black. Convergence: Integration of computing, communications, and broadcasting systems. Cookie: A text file containing tracking information such as dates and times of Web site visits, deposited by a Web site onto a user s computer. The text file is accessed each time the Web site is visited by a specific user and updated with browsing and other information. The main purpose of cookies is to identify users and possibly prepare customized Web site for them, including the personalization of advertising appearing on the Web sites. Coordinated Universal Time (UTC): a high precision atomic time standard with uniform seconds defined by International Time and leap seconds announced at regular intervals to compensate for the Earth s slowing rotation and other discrepancies. Leap seconds allow UTC to closely track Universal Time, a time standard based not on the uniform passage of seconds, but on the Earth s angular rotation. Time zones around the world are expressed as positive or negative offsets from UTC. Local time is UTC plus the time zone offset for that location, plus an offset (typically +1) for daylight savings, if in effect. For example, 3:00 a.m. Mountain Standard Time = 10:00 UTC 7. As the zero point reference, UTC is also referred to as Zulu time (Z). See also Normalization. Corrupted File: A file damaged in some way, such as by a virus, by software or hardware failure, or degradation with the passage of time, so that it is partially or completely unreadable by a computer. COTS (Commercial Off-the-Shelf): Hardware or software products that are commercially manufactured, ready-made, and available for use by the general public without the need for customization. CPI: Characters Per Inch. CPU (Central Processing Unit): The primary silicon chip that runs a computer s operating system and application software. It performs a computer s essential mathematical functions and controls essential operations. Also known as Microprocessor. CRC (Cyclical Redundancy Checking): Used in data communications to create a checksum character at the end of a data block to ensure integrity of data transmission and receipt. See Checksum. CRM (Customer Relationship Management) Application: Applications that help manage clients and contacts. Used in larger companies. Often a significant repository of sales, customer, and sometimes marketing data. Cross-Custodian De-Duplication: Culls a document to the extent multiple copies of that document reside within different custodians data sets. See Case De-Duplication and De-Duplication. CRT (Cathode Ray Tube): The picture tube of older computer monitors or televisions, to be distinguished from newer flat LCD or plasma screens. Cryptography: Technique to scramble data to preserve confidentiality or authenticity. 11

14 Cull (verb): To remove a document from the collection to be produced or reviewed. See Data Filtering, Harvesting. Custodian: See Record Custodian and Record Owner. Custodian De-Duplication: Culls a document to the extent multiple copies of that document reside within the same custodian s data set. Also known as Vertical De-duplication. See De-Duplication. Customer-Added Metadata: See User-Added Metadata. Cyan: Cyan-colored ink reflects blue and green and absorbs red. Cylinder: The set of tracks on both sides of each platter in a hard drive that is located at the same head position. See Platter. DAC (Digital to Analog Converter): Converts digital data to analog data. DAD (Digital Audio Disk): Another term for compact disk. DAT (Digital Audio Tape): A magnetic tape generally used to record audio but can hold up to 40 gigabytes (or 60 CDs) of data if used for data storage. Has the disadvantage of being a serial access device. Often used for backup. Data: Any information stored on a computer, whether created automatically by the computer, such as log files, or created by a user, such as the information entered on a spreadsheet. Data Categorization: The categorization and sorting of ESI - such as foldering by concept, content, subject, taxonomy, etc. - through the use of technology - such as search and retrieval software or artificial intelligence - to facilitate review and analysis. Data Collection: See Harvesting. Data Controller (as used in the EU Data Protection Act): The natural or legal person who alone or jointly with others determines the purposes for which and the manner in which any Personal Data are to be processed. Data Element: A combination of characters or bytes referring to one separate piece of information, such as name, address, or age. Data Encryption Standard (DES): A form of private key encryption developed by IBM in the late 1970s. Data Extraction: The process of parsing data from any electronic documents into separate fields such as Date Created, Date Last Accessed, and Text. Data Field: See Field. Data Filtering: The process of identifying for inclusion or exclusion of specific data based on specified parameters, such as date range, author(s), and/or keyword search terms. Data Formats: The organization of information for display, storage, or printing. Data is sometimes maintained in certain common formats so that it can be used by various programs, which may only work with data in a particular format, e.g., PDF, html. Data Harvesting: See Harvesting. 12

15 Data Mapping: A method for an organization to capture where its ESI is stored, physically and virtually, in what format it is stored, backup procedures in place, how the ESI moves and is used throughout the organization, information about accessibility of the ESI, retention and lifecycle management practices and policies, and identity of records custodians. Data Mining: Data mining generally refers to knowledge discovery in databases (structured data); often techniques for extracting summaries and reports from databases and data sets. In the context of electronic discovery, this term often refers to the processes used to cull through a collection of ESI to extract evidence for production or presentation in an investigation or in litigation. In certain bar association ethics opinions, mining metadata or mining an electronic document has been used to refer to the act of searching for and viewing ( hidden ) metadata embedded in an electronic document. See also Text Mining. Data Processor (as used in the EU Data Protection Act): A natural or legal person (other than an employee of the Data Controller) who processes Personal Data on behalf of the Data Controller. Data Set: A named or defined collection of data. See also Production Data Set and Privilege Data Set. Data Subject (as used in the EU Data Protection Act): An individual who is the subject of Personal Data. Data Verification: Assessment of data to ensure it has not been modified. The most common method of verification is hash coding by some method such as MD5, SHA1, or SHA2. See also Digital Fingerprint, File Level Binary Comparison, and Hash Coding. Database: In electronic records, a database is a set of data elements consisting of at least one file, or of a group of integrated files, usually stored in one location and made available to several users. Databases are sometimes classified according to their organizational approach, with the most prevalent approach being the relational database - a tabular database in which data is defined so that it can be reorganized and accessed in a number of different ways. Another popular organizational structure is the distributed database, which can be dispersed or replicated among different points in a network. Computer databases typically contain aggregations of data records or files, such as sales transactions, product catalogs and inventories, and customer profiles. SQL (Structured Query Language) is a standard computer language for making interactive queries from and updates to a database. Database Management System (DBMS): A software system used to access and retrieve data stored in a database. Date/Time Normalization: See Normalization. Date Created: The date a file was created on the media where it currently resides. If a file is moved to a new storage media, typically this date will reflect the date of the move. Date Last Accessed: The date the file was lasted accessed, meaning last opened or moved, or even copied depending on the technology used to copy. Date Last Modified: The date the file was last changed. The change is normally a substantive change to the document or its metadata and not a change to its storage location or an indication whether the file was opened and read. Date Sent: The date on which an was sent by the original author. Date Received: The date on which an was received. 13

16 Daubert (challenge): Daubert v. Merrell Dow Pharmaceuticals, 509 U.S. 579 (1993), addresses the admission of scientific expert testimony to ensure that the testimony is reliable before considered for admission pursuant to Federal Rule of Evidence 702. The court assesses the testimony by analyzing the methodology and applicability of the expert s approach. Faced with a proffer of expert scientific testimony, the trial judge must determine first, pursuant to Rule 104(a), whether the expert is proposing to testify to (1) scientific knowledge that (2) will assist the trier of fact to understand or determine a fact at issue. This involves preliminary assessment of whether the reasoning or methodology is scientifically valid and whether it can be applied to the facts at issue. Daubert suggests an open approach and provides a list of four potential factors: (1) whether the theory can be or has been tested; (2) whether the theory has been subjected to peer review or publication; (3) known or potential rate of error of that particular technique and the existence and maintenance of standards controlling the technique s operation; and (4) consideration of general acceptance within the scientific community. 509 U.S. at DDE (Dynamic Data Exchange): A form of interprocess communications used by Microsoft Windows to support the exchange of commands and data between two simultaneously running applications. DEB (Digital Evidence Bag): A standardized electronic wrapper or container for electronic evidence to preserve and transfer evidence in an encrypted or protected form that prevents deliberate or accidental alteration. The secure wrapper provides metadata concerning the collection process and context for the contained data. Decompression: To expand or restore compressed data back to its original size and format. See Compression. Decryption: Transformation of encrypted (or scrambled) data back to original form. De-Duplication ( De-Duping ): The process of comparing electronic records based on their characteristics and removing or marking duplicate records within the data set. The methodology deployed and definition of duplicate records should be agreed upon, i.e., whether an exact copy from a different location (such as a different mailbox, server tapes, etc.) is considered to be a duplicate. De-duplication can be selective, depending on the agreed-upon criteria. See also Case De-Duplication, Content Comparison, Cross-Custodian De- Duplication, Custodian De-Duplication, Data Verification, Digital Fingerprint, File Level Binary Comparison, Hash Coding, Horizontal De-Duplication, Metadata Comparison, and Near De-Duplication. De-Fragment ( de-frag ): Use of a computer utility to reorganize files so they are more contiguous on a hard drive or other storage medium, if the files or parts thereof have become fragmented and scattered in various locations within the storage medium in the course of normal computer operations. Used to optimize the operation of the computer, it will overwrite information in unallocated space. See Fragmented. Deleted Data: Data that existed on the computer as live data and which have been deleted by the computer system or end-user activity. Deleted data may remain on storage media in whole or in part until overwritten or wiped. Even after the data itself has been wiped, directory entries, pointers, or other information relating to the deleted data may remain on the computer. Soft deletions are data marked as deleted (and not generally available to the end-user after such marking), but not yet physically removed or overwritten. Soft-deleted data can be restored with complete integrity. Deleted File: A file with disk space that has been designated as available for reuse; the deleted file remains intact until it is overwritten. 14

17 Deletion: The process whereby data is removed from active files and other data storage structures on computers and rendered more inaccessible except through the use of special data recovery tools designed to recover deleted data. Deletion occurs on several levels in modern computer systems: (a) File level deletion renders the file inaccessible to the operating system and normal application programs and marks the storage space occupied by the file s directory entry and contents as free and available to re-use for data storage, (b) Record level deletion occurs when a record is rendered inaccessible to a database management system (DBMS) (usually marking the record storage space as available for re-use by the DBMS, although in some cases the space is never reused until the database is compacted) and is also characteristic of many systems (c) Byte level deletion occurs when text or other information is deleted from the file content (such as the deletion of text from a word processing file); such deletion may render the deleted data inaccessible to the application intended to be used in processing the file, but may not actually remove the data from the file s content until a process such as compaction or rewriting of the file causes the deleted data to be overwritten. De-NIST: The use of an automated filter program that screens files against the NIST list of computer file types to separate those generated by a system and those generated by a user. See NIST List. Descenders: The portion of a character that falls below the main part of the letter (e.g., g, p, q). De-shading: Removing shaded areas to render images more easily recognizable by OCR. De-shading software typically searches for areas with a regular pattern of tiny dots. De-skewing: The process of straightening skewed (tilted) images. De-skewing is one of the image enhancements that can improve OCR accuracy. Documents often become skewed when scanned or faxed. Desktop: Generally refers to the working area of the display on an individual PC. De-speckling: Removing isolated speckles from an image file. Speckles often develop when a document is scanned or faxed. See Speckle. DIA/DCA (Document Interchange Architecture): An IBM standard for transmission and storage of voice, text, or video over networks. Digital: Information stored as a string of ones and zeros (numeric). Opposite of analog. Digital Certificate: Electronic records that contain keys used to decrypt information, especially information sent over a public network like the Internet. See Certificate, Digital Signature, and PKI Digital Signature. Digital Fingerprint: A fixed-length hash code that uniquely represents the binary content of a file. See also Data Verification and File Level Binary Comparison and Hash Coding. Digital Signature: A way to ensure the identity of the sender, utilizing public key cryptography and working in conjunction with certificates. See Certificate, Digital Certificate, and PKI Digital Signature. Digitize: The process of converting an analog value into a digital (numeric) representation. Directory: A simulated file folder or container used to organize files and directories in a hierarchical or tree-like structure. UNIX and DOS use the term directory, while Mac and Windows use the term folder. Dirty Text: OCR output reflecting text as read by the OCR engine(s) with no clean-up. 15

18 Disaster Recovery Tapes: Portable media used to store data for backup purposes. See Backup Data/Backup Tapes. Disk mirroring: A method of protecting data from a catastrophic hard disk failure or for long term data storage. As each file is stored on the hard disk, a mirror copy is made on a second hard disk or on a different part of the same disk. See also Mirror Image and Mirroring. Disk Partition: A hard drive containing a set of consecutive cylinders. Disk/Disk: Round, flat storage media with layers of material that enable the recording of data. Discovery: Discovery is the process of identifying, locating, securing, and producing information and materials for the purpose of obtaining evidence for utilization in the legal process. The term is also used to describe the process of reviewing all materials that may be potentially relevant to the issues at hand and/or that may need to be disclosed to other parties, and of evaluating evidence to prove or disprove facts, theories, or allegations. There are several ways to conduct discovery, the most common of which are interrogatories, requests for production of documents, and depositions. Diskwipe: Utility that overwrites existing data. Various utilities exist with varying degrees of efficiency - some wipe only named files or unallocated space of residual data, thus unsophisticated users who try to wipe evidence may leave behind files of which they are unaware. Disposition: The final business action carried out on a record. This action generally is to destroy or archive the record. Electronic record disposition can include soft deletions (see Deletion), hard deletions, hard deletions with overwrites, archive to long-term store, forward to organization, and copy to another media or format and delete (hard or soft). Distributed Data: Information belonging to an organization that resides on portable media and non-local devices such as remote offices, home computers, laptop computers, personal digital assistants ( PDAs ), wireless communication devices (e.g., BlackBerry ) and Internet repositories (including hosted by Internet service providers or portals and Web sites). Distributed data also includes data held by third parties such as application service providers and business partners. Note: Information Technology organizations may define distributed data differently (for example, in some organizations distributed data includes any non-serverbased data, including workstation disk drives). Dithering: In printing, dithering is usually called halftoning, and shades of gray are called halftones. The more dither patterns that a device or program supports, the more shades of gray it can represent. Dithering is the process of converting grays to different densities of black dots, usually for the purposes of printing or storing color or grayscale images as black and white images. DLT (Digital Linear Tape): A type of backup tape that can hold up to 80 GB depending on the data file format. DMCA (Digital Millennium Copyright Act): United States copyright law to protect against copyright infringement of data, address rights, and obligations of owners of copyrighted material, and the rights and obligations of internet service providers on whose systems the infringing material may reside. Document (or Document Family): A collection of pages or files produced manually or by a software application, constituting a logical single communication of information, but consisting of more than a single stand-alone record. Examples include a fax cover, the faxed letter, and an attachment to the letter - the fax cover being the Parent, and the letter and attachment being a Child. See also Attachment, Load File, Message Unit, and Unitization - Physical and Logical. 16

19 Document Date: For documents originating as paper, the document date is usually the date manually captured from the face of the document. The date is sometimes estimated based on the content of the document if no specific date can be found. Documents originating in electronic form have several dates associated them. See Also: Date Last Modified, Date Created, Date Last Accessed, Date Sent, and Date Received. Document Imaging Programs: Software used to scan paper documents and to store, manage, retrieve, and distribute documents quickly and easily. Document Metadata: Properties about the file stored in the file, as opposed to document content. Often this data is not immediately viewable in the software application used to create/edit the document but often can be accessed via a Properties view. Examples include document author and company, and create and revision dates. Contrast with File System Metadata and Metadata. See also Metadata. Document Type or Doc Type: A typical field used in bibliographical coding. Typical doc type examples include correspondence, memo, report, article, and others. DoD 5015: Department of Defense standard addressing records management. Domain: A sub-network of servers and computers. Domain information is useful when restoring backup tapes, particularly of . Domino Database: Another name for Lotus Notes Databases versions 5.0 or higher. See NSF. DOS: See MS-DOS. Dot Pitch: Distance of one pixel in a CRT to the next pixel on the vertical plane. The smaller the number, the higher quality display. Double Byte Language: See Unicode. Download: To move data from another location to one s own, usually over a network or the Internet; indicates that data is being transmitted from one location to another location. See Upload. DPI (Dots Per Inch): The measurement of the resolution of display in printing systems. A typical CRT screen provides 96 DPI, which provides 9,216 dots per square inch (96x96). When a paper document is scanned, the resolution, or level of detail, at which the scanning was performed is expressed in DPI. Typically, documents are scanned at 200 or 300 DPI. Draft Record: A preliminary version of a record before it has been completed, finalized, accepted, validated or filed. Such records include working files and notes. Records and information management policies may provide for the destruction of draft records upon finalization, acceptance, validation, or filing of the final or official version of the record. However, draft records generally must be retained if (1) they are deemed to be subject to a legal hold; or (2) a specific law or regulation mandates their retention and policies should recognize such exceptions. Drag-and-Drop: The movement of on-screen objects by dragging them with the mouse, and dropping them in another place. DRAM: Dynamic Random Access Memory, a memory technology that is periodically refreshed or updated as opposed to static RAM chips that do not require refreshing. The term is often used to refer to the memory chips themselves. 17

20 Drive Geometry: A computer hard drive is made up of a number of rapidly rotating platters that have a set of read/write heads on both sides of each platter. Each platter is divided into a series of concentric rings called tracks. Each track is further divided into sections called sectors, and each sector is sub-divided into bytes. Drive geometry refers to the number and positions of each of these structures. Driver: A computer program that controls various devices such as the keyboard, mouse, monitor, etc., and integrates them with other programs on a computer. Drop-Down Menu: A menu window that opens on-screen to display context-related options. Also called pop-up menu or pull-down menu. DRM (Digital Rights Management): Technology that controls access to protected data. DSP (Digital Signal Processor/Processing): A special purpose computer (or technique) which digitally processes signals and electrical/analog waveforms. DTP (Desktop Publishing): PC applications used to prepare direct print output or output suitable for printing presses. Duplex Scanners vs. Double-Sided Scanning: Duplex scanners automatically scan both sides of a double-sided page, producing two images at once. Double-sided scanning uses a single-sided scanner to scan double-sided pages, scanning one collated stack of paper, then flipping it over and scanning the other side. Duplex: Two-sided page(s). DVD (Digital Video Disk or Digital Versatile Disk): A plastic disk, like a CD, on which data can be written and read. DVDs can hold more information and can support more data formats than CDs. Formats include: DVD-R or DVD+R ( DVD Recordable ) - written to once and are then read-only; and DVD-RW ( DVD Re-Writable ) - can be written to multiple times. ECM: Enterprise content management. EDB: Standing for Exchange Database, it is a Microsoft Exchange Server container file. EDI (Electronic Data Interchange): Eliminating forms altogether by encoding the data as close as possible to the point of the transaction; automated business information exchange. EDMS (Electronic Document Management System): A system to electronically manage documents during all life cycles. See Electronic Document Management. EGA (Extended Graphics Adapter): See VGA. EIA: Electronic Industries Association. EIM: Electronic Image Management. EISA (Extended Industry Standard Architecture): One of the standard buses used for PCs. Electronic Discovery ( E-Discovery ): The process of identifying, preserving, collecting, preparing, reviewing, and producing electronically stored information ( ESI ) in the context of the legal process. See Discovery. 18